M1: add per-IP rate limiting to API endpoints #50
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The unauthenticated API key bootstrap endpoints and all /api/v1/* routes have no rate limiting. An attacker or misconfigured client can send unbounded requests, exhausting database connections, CPU, or memory. The bootstrap endpoints are especially exposed as they can be called in a tight loop without a valid API key.
Plan: add RateLimitMiddleware to middleware.py using a sliding-window per-IP counter (pure Python, no new deps). Two tiers: bootstrap endpoints at 10 req/min, general API at 120 req/min. Add rate_limit_bootstrap_rpm and rate_limit_api_rpm settings to config.py. Register between SessionMiddleware and APIKeyMiddleware in main.py. New test file tests/test_rate_limiting.py with an isolated Starlette test app (no DB needed). Mark M1 resolved in both audit documents.